CSV Injection Vulnerability in Business Directory Plugin for WordPress

CVE-2023-5527

Summary

The Business Directory Plugin for WordPress, developed by Strategies, Inc., is susceptible to a CSV Injection vulnerability in versions up to and including 6.4.3. This vulnerability resides in the class-csv-exporter.php file, allowing authenticated users with author-level permissions and above to embed malicious input into CSV files that are exported by administrators. When these CSV files are opened on a local system with a vulnerable configuration, it can lead to untrusted code execution. Users of affected versions should review their permissions and consider updating to secure their installations.

References